Firefox Permissions: How the System Works and How to Audit Your Site Permissions

Firefox tracks what permissions you've granted to websites — camera, microphone, location, notifications, and more. Here's how the permissions system works and how to audit it.

The Permissions Architecture

Firefox follows the Permissions API standard. When a site requests access to a sensitive resource, Firefox:

1. Shows a permission prompt (on first request)
2. Stores your decision (allow/block) per origin
3. Respects subsequent requests automatically based on stored decision

Permissions are stored in your profile's permissions.sqlite database.

Viewing All Permissions

Settings → Privacy & Security → Permissions

Shows permissions by type:

• Location
• Camera
• Microphone
• Notifications
• Autoplay
• Block Pop-ups
• Virtual Reality (WebXR)

Click "Settings…" next to any permission type to see all sites with that permission and revoke/change individual sites.

Per-Site Permissions from the Address Bar

Click the lock icon (or information icon) in the address bar → "Connection Secure" → "More Information" → "Permissions" tab.

This shows all permissions for the current site and lets you change them without going to Settings.

Keyboard shortcut: Click the lock icon while on a site → "Permissions" section appears directly.

Page Info Permissions

Ctrl+I opens Page Info for the current site. The "Permissions" tab shows every permission type and the current setting for this site.

Temporary Permission Grants

For some permissions (camera, microphone), you can allow access only once (or for the current session) rather than permanently. The prompt usually shows:

• "Allow" (persistent)
• "Allow for This Session" (expires when you close Firefox)
• "Don't Allow"

Temporary grants are useful for sites you trust for a one-time use but don't want to permanently allow.

Auto-Permissions via Prompts

Firefox can be configured to handle permissions in different ways per-type:

about:config settings:

• permissions.default.camera: 0=Ask, 1=Allow, 2=Block
• permissions.default.microphone: 0=Ask, 1=Allow, 2=Block
• permissions.default.geo: 1=Ask, 2=Block (default varies)
• permissions.default.desktop-notification: 0=Ask, 1=Allow, 2=Block

Setting to 2 (Block) globally means no site can request that permission — Firefox silently denies it without a prompt. Useful for notifications (set to 2 to never see notification prompts again).

Location Permission

Firefox's geolocation uses a combination of:

• GPS (if available, mainly mobile)
• Wi-Fi network scanning (most common on desktop)
• IP geolocation (fallback)

Firefox uses Google's location service for Wi-Fi/network-based location by default (it sends nearby Wi-Fi SSIDs to Google's API). You can change this:

about:config → geo.provider.network.url — The URL of the location provider.

Alternative providers: Mozilla's own location service at https://location.services.mozilla.com/v1/geolocate?key=%MOZILLA_API_KEY%.

Or disable network location: about:config → geo.provider.ms-windows-location = false (Windows), geo.provider.use_corelocation = false (macOS), geo.provider.use_gpsd = false (Linux).

Clipboard Permission

The Clipboard API allows sites to read from your clipboard with permission. Firefox shows a prompt when a site requests clipboard read access.

about:config → dom.events.asyncClipboard.read — Whether to enable async clipboard read (default: true in modern Firefox).

Sites can always write to your clipboard (copy button functionality) without permission. Reading your clipboard requires explicit permission.

Storage Access API

Third-party iframes (e.g., Facebook widget embedded in a news site) can request "Storage Access" — permission to access their cookies cross-origin.

Firefox prompts for this. Granting it allows the iframe to read cookies set from the third-party's own origin.

Firefox's Total Cookie Protection (which partitions cross-site cookies) can interact with this — Storage Access essentially bypasses partitioning for specific sites you approve.

Permission Cleanup

Over time, you accumulate permissions for sites you no longer visit. Audit periodically:

Settings → Privacy & Security → Permissions → [each type] → Settings → review the list.

Or: Settings → Privacy & Security → Cookies and Site Data → Manage Data → remove cookies for sites you don't use (this also removes their permissions).

Developer Testing Permissions

For web developers testing permission-dependent features:

1. Open DevTools (F12) → Application → Permissions (or: about:devtools-toolbox)
2. The Storage section shows cookies and site data

To reset all permissions for a site during testing: address bar → lock icon → "Remove Permission" or go to Page Info (Ctrl+I) → Permissions → reset all.

---

The most useful periodic action: Settings → Permissions → Notifications → review and revoke notification access for sites you no longer care about. Notification permission databases grow silently and can be surprisingly large.